The senior advisor, Spencer, has a misconception regarding?

SCENARIO

Please use the following to answer the next QUESTION:

Natalia, CFO of the Nationwide Grill restaurant chain, had never seen her fellow executives so anxious. Last week, a data processing firm used by the company reported that its system may have been hacked, and customer data such as names, addresses, and birthdays may have been compromised. Although the attempt was proven unsuccessful, the scare has prompted several Nationwide Grill executives to Question the company’s privacy program at today’s meeting.

Alice, a vice president, said that the incident could have opened the door to lawsuits, potentially damaging Nationwide Grill’s market position. The Chief Information Officer (CIO), Brendan, tried to assure her that even if there had been an actual breach, the chances of a successful suit against the company were slim. But Alice remained unconvinced.

Spencer C a former CEO and currently a senior advisor C said that he had always warned against the use of contractors for data processing. At the very least, he argued, they should be held contractually liable for telling customers about any security incidents. In his view, Nationwide Grill should not be forced to soil the company name for a problem it did not cause.

One of the business development (BD) executives, Haley, then spoke, imploring everyone to see reason.

"Breaches can happen, despite organizations’ best efforts," she remarked. "Reasonable preparedness is key." She reminded everyone of the incident seven years ago when the large grocery chain Tinkerton’s had its financial information compromised after a large order of Nationwide Grill frozen dinners. As a long-time BD executive with a solid understanding of Tinkerton’s’s corporate culture, built up through many years of cultivating relationships, Haley was able to successfully manage the company’s incident response.

Spencer replied that acting with reason means allowing security to be handled by the security functions within the company C not BD staff. In a similar way, he said, Human Resources (HR) needs

to do a better job training employees to prevent incidents. He pointed out that Nationwide Grill employees are overwhelmed with posters, emails, and memos from both HR and the ethics department related to the company’s privacy program. Both the volume and the duplication of information means that it is often ignored altogether.

Spencer said, "The company needs to dedicate itself to its privacy program and set regular in-person trainings for all staff once a month."

Alice responded that the suggestion, while well-meaning, is not practical. With many locations, local HR departments need to have flexibility with their training schedules. Silently, Natalia agreed.

The senior advisor, Spencer, has a misconception regarding?
A . The amount of responsibility that a data controller retains.
B . The appropriate role of an organization’s security department.
C . The degree to which training can lessen the number of security incidents.
D . The role of Human Resources employees in an organization’s privacy program.

View Answer

Answer: A

Explanation:

Spencer has a misconception regarding the amount of responsibility that a data controller retains, as he suggests that the contractors should be held contractually liable for telling customers about any security incidents, and that Nationwide Grill should not be forced to soil the company name for a problem it did not cause. However, as a data controller, Nationwide Grill is ultimately responsible for ensuring that the personal data of its customers is processed in compliance with applicable laws and regulations, regardless of whether it uses contractors or not. Nationwide Grill cannot transfer or delegate its accountability or liability to the contractors, and it has a duty to inform the customers and the relevant authorities of any security incidents or breaches that may affect their data. Therefore, Spencer’s view is unrealistic and risky, as it may expose Nationwide Grill to legal actions, fines, reputational damage and loss of trust.